@yielded/auth 0.1.0-beta.1

package/dist/drizzle/passkey-model.d.mts

@@ -0,0 +1,275 @@
+import { SubjectId } from "../Schema.mjs";
+import { DrizzleMappingError } from "./model.mjs";
+import { PasskeyCeremony, PasskeyCredential } from "../passkey/models.mjs";
+import { PasskeyCredentials } from "../passkey/PasskeyCredentials.mjs";
+import { PasskeyEnrollmentContext } from "../passkey/PasskeyEnrollmentContext.mjs";
+import { PasskeyMethodPolicy } from "../passkey/policy.mjs";
+import { PasskeyPersistence } from "../passkey/PasskeyPersistence.mjs";
+import { Effect, Layer } from "effect";
+import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
+//#region src/drizzle/passkey-model.d.ts
+type PasskeyColumn<T extends Table> = Extract<keyof T["_"]["columns"], string>;
+type PasskeyMappingSource<M, RSetup = never> = M | Effect.Effect<M, DrizzleMappingError, RSetup>;
+interface PasskeyCredentialServices {
+  readonly passkeyCredentials: PasskeyCredentials["Service"];
+}
+interface PasskeyPersistenceServices {
+  readonly passkeyPersistence: PasskeyPersistence["Service"];
+}
+interface PasskeyEnrollmentContextServices {
+  readonly passkeyEnrollmentContext: PasskeyEnrollmentContext["Service"];
+}
+declare const passkeyCredentialsLayer: <E, R>(services: Effect.Effect<PasskeyCredentialServices, E, R>) => Layer.Layer<PasskeyCredentials, E, R>;
+declare const passkeyPersistenceLayer: <E, R>(services: Effect.Effect<PasskeyPersistenceServices, E, R>) => Layer.Layer<PasskeyPersistence, E, R>;
+declare const passkeyEnrollmentContextLayer: <E, R>(services: Effect.Effect<PasskeyEnrollmentContextServices, E, R>) => Layer.Layer<PasskeyEnrollmentContext, E, R>;
+/** Native IDs roundtrip exactly; protocol IDs and authentication references are
+ * different identities. These callbacks never suspend inside an owner. */
+interface PasskeySubjectIdCodec<N> {
+  readonly toNative: (id: SubjectId) => N;
+  readonly toSubject: (id: N) => SubjectId;
+  readonly equals: (left: N, right: N) => boolean;
+}
+interface PasskeyClock {
+  readonly encodeInstant: (millis: number) => unknown;
+  readonly decodeInstant: (value: unknown) => number;
+  readonly engineNowMillis: SQL;
+  readonly toMillis: (expression: SQL) => SQL;
+  readonly fromMillis: (expression: SQL) => SQL;
+}
+interface PasskeySubjectReadTable<T extends Table, N> {
+  readonly table: T;
+  readonly id: PasskeyColumn<T>;
+  readonly status: PasskeyColumn<T>;
+  readonly securityRevision: PasskeyColumn<T>;
+  readonly decodeId: (row: Readonly<Partial<InferSelectModel<T>>>) => N;
+  readonly isActiveStatus: (value: unknown) => boolean;
+  readonly activeCondition: SQL;
+}
+interface PasskeyFactorReadTable<T extends Table> {
+  readonly table: T;
+  readonly subjectId: PasskeyColumn<T>;
+  readonly credentialId: PasskeyColumn<T>;
+  readonly revision: PasskeyColumn<T>;
+  readonly status: PasskeyColumn<T>;
+  readonly isActiveStatus: (value: unknown) => boolean;
+  readonly activeCondition: SQL;
+}
+/** decode uses only these declared columns. Counter columns are native integral
+ * numbers; BS may use a consumer enum. Name/creation metadata is not required. */
+interface PasskeyCredentialReadTable<T extends Table, N> {
+  readonly table: T;
+  readonly credentialId: PasskeyColumn<T>;
+  readonly subjectId: PasskeyColumn<T>;
+  readonly rpId: PasskeyColumn<T>;
+  readonly protocolCredentialId: PasskeyColumn<T>;
+  readonly credentialKey: PasskeyColumn<T>;
+  readonly handleKey: PasskeyColumn<T>;
+  readonly userHandle: PasskeyColumn<T>;
+  readonly publicKey: PasskeyColumn<T>;
+  readonly algorithm: PasskeyColumn<T>;
+  readonly profile: PasskeyColumn<T>;
+  readonly credentialRevision: PasskeyColumn<T>;
+  readonly status: PasskeyColumn<T>;
+  readonly primarySignIn: PasskeyColumn<T>;
+  readonly enrollmentUserVerified: PasskeyColumn<T>;
+  readonly backupEligible: PasskeyColumn<T>;
+  readonly backupState: PasskeyColumn<T>;
+  readonly counter: PasskeyColumn<T>;
+  readonly maximumCounter: PasskeyColumn<T>;
+  readonly decode: (row: Readonly<Partial<InferSelectModel<T>>>) => Omit<PasskeyCredential, "revision" | "active">;
+  readonly decodeSubjectId: (row: Readonly<Partial<InferSelectModel<T>>>) => N;
+  readonly isActiveStatus: (value: unknown) => boolean;
+  readonly activeCondition: SQL;
+}
+interface PasskeyCredentialOwnershipTable<T extends Table, N> {
+  readonly table: T;
+  readonly credentialKey: PasskeyColumn<T>;
+  readonly rpId: PasskeyColumn<T>;
+  readonly protocolCredentialId: PasskeyColumn<T>;
+  readonly subjectId: PasskeyColumn<T>;
+  readonly credentialId: PasskeyColumn<T>;
+  readonly state: PasskeyColumn<T>;
+  readonly version: PasskeyColumn<T>;
+  readonly reservationId: PasskeyColumn<T>;
+  readonly ownedCondition: SQL;
+  readonly isOwnedState: (value: unknown) => boolean;
+  readonly decodeSubjectId: (row: Readonly<Partial<InferSelectModel<T>>>) => N;
+}
+/** Reservations do not manufacture a subject; bound handles are RP-global. */
+interface PasskeyHandleReadTable<T extends Table> {
+  readonly table: T;
+  readonly handleKey: PasskeyColumn<T>;
+  readonly rpId: PasskeyColumn<T>;
+  readonly userHandle: PasskeyColumn<T>;
+  readonly state: PasskeyColumn<T>;
+  readonly version: PasskeyColumn<T>;
+  readonly reservationId: PasskeyColumn<T>;
+}
+interface PasskeyHandleReservationTable<T extends Table> extends PasskeyHandleReadTable<T> {
+  readonly reservedCondition: SQL;
+  readonly isReservedState: (value: unknown) => boolean;
+}
+interface PasskeyHandleOwnershipTable<T extends Table, N> extends PasskeyHandleReadTable<T> {
+  readonly subjectId: PasskeyColumn<T>;
+  readonly ownedCondition: SQL;
+  readonly isOwnedState: (value: unknown) => boolean;
+  readonly decodeSubjectId: (row: Readonly<Partial<InferSelectModel<T>>>) => N;
+}
+declare const requiredPasskeyCredentialConstraints: {
+  readonly credentialId: readonly ["credentialId"];
+  readonly factor: readonly ["subjectId", "credentialId"];
+  readonly credentialOwnership: readonly ["credentialKey"];
+  readonly handleOwnership: readonly ["handleKey"];
+  readonly boundSubjectHandle: readonly ["rpId", "subjectId"];
+};
+interface PasskeyCredentialMapping<S extends Table, C extends Table, F extends Table, Ownership extends Table, Handle extends Table, N> {
+  readonly subject: PasskeySubjectReadTable<S, N>;
+  readonly credential: PasskeyCredentialReadTable<C, N>;
+  readonly authority: PasskeyFactorReadTable<F>;
+  readonly credentialOwnership: PasskeyCredentialOwnershipTable<Ownership, N>;
+  readonly handleOwnership: PasskeyHandleOwnershipTable<Handle, N>;
+  readonly subjectIds: PasskeySubjectIdCodec<N>;
+  readonly constraints: typeof requiredPasskeyCredentialConstraints;
+}
+/** A stable additional policy row, acquired before RP/credential locks. The
+ * factory checks column names without erasing the consumer table at its input. */
+declare const PasskeyPolicyGuardTypeId: unique symbol;
+interface PasskeyPolicyGuard {
+  readonly [PasskeyPolicyGuardTypeId]: true;
+  readonly scope: string;
+  readonly table: Table;
+  readonly columns: ReadonlyArray<string>;
+  readonly where: (moduleId: string) => SQL;
+  readonly condition: (moduleId: string) => SQL;
+}
+declare const passkeyPolicyGuard: <T extends Table>(input: {
+  readonly scope: string;
+  readonly table: T;
+  readonly columns: ReadonlyArray<PasskeyColumn<T>>;
+  readonly where: (moduleId: string) => SQL;
+  readonly condition: (moduleId: string) => SQL;
+}) => PasskeyPolicyGuard;
+interface PasskeyModuleTable<T extends Table> {
+  readonly table: T;
+  readonly moduleId: PasskeyColumn<T>;
+  readonly status: PasskeyColumn<T>;
+  readonly policyRevision: PasskeyColumn<T>;
+  /** All physical fields used by decodeMethodPolicy, including policyRevision. */
+  readonly policyColumns: ReadonlyArray<PasskeyColumn<T>>;
+  readonly isActiveStatus: (value: unknown) => boolean;
+  readonly activeCondition: SQL;
+  readonly decodeMethodPolicy: (row: Readonly<Partial<InferSelectModel<T>>>) => PasskeyMethodPolicy;
+  readonly guards?: ReadonlyArray<PasskeyPolicyGuard>;
+}
+type PasskeyFlowState = "Pending" | "Claimed" | "Verified" | "Rejected" | "Ambiguous" | "RegistrationAccepted" | "ProvisioningPending";
+interface PasskeyFlowInsert {
+  readonly ceremony: PasskeyCeremony;
+  readonly policy: PasskeyMethodPolicy;
+  readonly marker: string;
+}
+interface PasskeyFlowTable<T extends Table> {
+  readonly table: T;
+  readonly moduleId: PasskeyColumn<T>;
+  readonly flowId: PasskeyColumn<T>;
+  readonly commandId: PasskeyColumn<T>;
+  readonly purpose: PasskeyColumn<T>;
+  readonly state: PasskeyColumn<T>;
+  readonly version: PasskeyColumn<T>;
+  readonly generation: PasskeyColumn<T>;
+  readonly snapshot: PasskeyColumn<T>;
+  readonly policySnapshot: PasskeyColumn<T>;
+  readonly requestBindingVerifier: PasskeyColumn<T>;
+  readonly requestBindingExpiresAt: PasskeyColumn<T>;
+  readonly issuedAt: PasskeyColumn<T>;
+  readonly expiresAt: PasskeyColumn<T>;
+  readonly retentionUntil: PasskeyColumn<T>;
+  readonly claimId: PasskeyColumn<T>;
+  readonly claimedAt: PasskeyColumn<T>;
+  readonly claimExpiresAt: PasskeyColumn<T>;
+  readonly credentialSnapshot: PasskeyColumn<T>;
+  /** Core SubjectId scope text, not a consumer's native subject ID. */
+  readonly subjectScope: PasskeyColumn<T>;
+  readonly targetScope: PasskeyColumn<T>;
+  readonly states: Readonly<Record<PasskeyFlowState, unknown>>;
+  readonly encodeInsert: (input: PasskeyFlowInsert) => InferInsertModel<T>;
+}
+interface PasskeyAdmissionTable<T extends Table> {
+  readonly table: T;
+  readonly authorityScope: PasskeyColumn<T>;
+  readonly moduleId: PasskeyColumn<T>;
+  readonly version: PasskeyColumn<T>;
+  readonly ownerMarker: PasskeyColumn<T>;
+  /** One physical clock sample, reused by every charge of this decision. */
+  readonly admittedAt: PasskeyColumn<T>;
+}
+type PasskeyChargeKind = "global" | "subject" | "target";
+interface PasskeyChargeInsert {
+  readonly moduleId: string;
+  readonly flowId: string;
+  readonly purpose: PasskeyCeremony["purpose"];
+  readonly kind: PasskeyChargeKind;
+  readonly scope: string;
+  readonly originalWindowMillis: number;
+  readonly marker: string;
+}
+/** Charge scope is canonical core identity text; this subject-free descriptor
+ * can count all purposes without decoding any unrelated native subject. */
+interface PasskeyChargeTable<T extends Table> {
+  readonly table: T;
+  readonly moduleId: PasskeyColumn<T>;
+  readonly flowId: PasskeyColumn<T>;
+  readonly purpose: PasskeyColumn<T>;
+  readonly kind: PasskeyColumn<T>;
+  readonly scope: PasskeyColumn<T>;
+  readonly originalWindowMillis: PasskeyColumn<T>;
+  readonly admittedAt: PasskeyColumn<T>;
+  readonly retainUntil: PasskeyColumn<T>;
+  readonly version: PasskeyColumn<T>;
+  readonly ownerMarker: PasskeyColumn<T>;
+  readonly encodeInsert: (input: PasskeyChargeInsert) => InferInsertModel<T>;
+}
+declare const requiredPasskeyPersistenceConstraints: {
+  readonly flow: readonly ["moduleId", "flowId"];
+  readonly command: readonly ["moduleId", "commandId"];
+  readonly admission: readonly ["authorityScope", "moduleId"];
+  readonly charge: readonly ["moduleId", "flowId", "kind"];
+};
+interface PasskeyCeremonyMapping<Module extends Table, Flow extends Table, Admission extends Table, Charge extends Table> {
+  readonly moduleId: string;
+  readonly authorityScope: string;
+  readonly module: PasskeyModuleTable<Module>;
+  readonly flow: PasskeyFlowTable<Flow>;
+  readonly admission: PasskeyAdmissionTable<Admission>;
+  readonly charge: PasskeyChargeTable<Charge>;
+  readonly clock: PasskeyClock;
+  readonly constraints: typeof requiredPasskeyPersistenceConstraints;
+}
+type CredentialTable<Read> = Read extends {
+  readonly credential: {
+    readonly table: infer T extends Table;
+  };
+} ? T : never;
+interface PasskeyPersistenceMapping<Read, Module extends Table, Flow extends Table, Admission extends Table, Charge extends Table, N> extends PasskeyCeremonyMapping<Module, Flow, Admission, Charge> {
+  readonly read: Read & {
+    readonly subjectIds: PasskeySubjectIdCodec<N>;
+  };
+  readonly telemetry: {
+    readonly lastUsedAt: PasskeyColumn<CredentialTable<Read>>;
+    readonly encodeBackupState: (value: boolean) => unknown;
+  };
+}
+interface PasskeyEnrollmentContextMapping<Read, Module extends Table, N> {
+  readonly moduleId: string;
+  readonly read: Read & {
+    readonly subjectIds: PasskeySubjectIdCodec<N>;
+  };
+  readonly module: PasskeyModuleTable<Module>;
+}
+interface D1PasskeyMapping {
+  readonly d1: {
+    readonly primary: true;
+  };
+}
+//#endregion
+export { D1PasskeyMapping, PasskeyAdmissionTable, PasskeyCeremonyMapping, PasskeyChargeInsert, PasskeyChargeKind, PasskeyChargeTable, PasskeyClock, PasskeyColumn, PasskeyCredentialMapping, PasskeyCredentialOwnershipTable, PasskeyCredentialReadTable, PasskeyCredentialServices, PasskeyEnrollmentContextMapping, PasskeyEnrollmentContextServices, PasskeyFactorReadTable, PasskeyFlowInsert, PasskeyFlowState, PasskeyFlowTable, PasskeyHandleOwnershipTable, PasskeyHandleReadTable, PasskeyHandleReservationTable, PasskeyMappingSource, PasskeyModuleTable, PasskeyPersistenceMapping, PasskeyPersistenceServices, PasskeyPolicyGuard, PasskeySubjectIdCodec, PasskeySubjectReadTable, passkeyCredentialsLayer, passkeyEnrollmentContextLayer, passkeyPersistenceLayer, passkeyPolicyGuard, requiredPasskeyCredentialConstraints, requiredPasskeyPersistenceConstraints };
+//# sourceMappingURL=passkey-model.d.mts.map

package/dist/drizzle/passkey-model.mjs

@@ -0,0 +1,36 @@
+import { PasskeyCredentials } from "../passkey/PasskeyCredentials.mjs";
+import { PasskeyEnrollmentContext } from "../passkey/PasskeyEnrollmentContext.mjs";
+import { PasskeyPersistence } from "../passkey/PasskeyPersistence.mjs";
+import { Effect, Layer } from "effect";
+//#region src/drizzle/passkey-model.ts
+const passkeyCredentialsLayer = (services) => Layer.effect(PasskeyCredentials, Effect.map(services, (value) => value.passkeyCredentials));
+const passkeyPersistenceLayer = (services) => Layer.effect(PasskeyPersistence, Effect.map(services, (value) => value.passkeyPersistence));
+const passkeyEnrollmentContextLayer = (services) => Layer.effect(PasskeyEnrollmentContext, Effect.map(services, (value) => value.passkeyEnrollmentContext));
+const requiredPasskeyCredentialConstraints = {
+	credentialId: ["credentialId"],
+	factor: ["subjectId", "credentialId"],
+	credentialOwnership: ["credentialKey"],
+	handleOwnership: ["handleKey"],
+	boundSubjectHandle: ["rpId", "subjectId"]
+};
+/** A stable additional policy row, acquired before RP/credential locks. The
+* factory checks column names without erasing the consumer table at its input. */
+const PasskeyPolicyGuardTypeId = Symbol("effect-auth/drizzle/PasskeyPolicyGuard");
+const passkeyPolicyGuard = (input) => ({
+	...input,
+	[PasskeyPolicyGuardTypeId]: true
+});
+const requiredPasskeyPersistenceConstraints = {
+	flow: ["moduleId", "flowId"],
+	command: ["moduleId", "commandId"],
+	admission: ["authorityScope", "moduleId"],
+	charge: [
+		"moduleId",
+		"flowId",
+		"kind"
+	]
+};
+//#endregion
+export { passkeyCredentialsLayer, passkeyEnrollmentContextLayer, passkeyPersistenceLayer, passkeyPolicyGuard, requiredPasskeyCredentialConstraints, requiredPasskeyPersistenceConstraints };
+
+//# sourceMappingURL=passkey-model.mjs.map

package/dist/drizzle/passkey-model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-model.mjs","names":[],"sources":["../../src/drizzle/passkey-model.ts"],"sourcesContent":["import type { InferInsertModel, InferSelectModel, SQL, Table } from \"drizzle-orm\";\nimport { Effect, Layer } from \"effect\";\n\nimport type { PasskeyCeremony, PasskeyCredential } from \"../passkey/models\";\nimport { PasskeyCredentials } from \"../passkey/PasskeyCredentials\";\nimport { PasskeyEnrollmentContext } from \"../passkey/PasskeyEnrollmentContext\";\nimport { PasskeyPersistence } from \"../passkey/PasskeyPersistence\";\nimport type { PasskeyMethodPolicy } from \"../passkey/policy\";\nimport type { SubjectId } from \"../Schema\";\nimport type { DrizzleMappingError } from \"./model\";\n\nexport type PasskeyColumn<T extends Table> = Extract<keyof T[\"_\"][\"columns\"], string>;\n\nexport type PasskeyMappingSource<M, RSetup = never> =\n  | M\n  | Effect.Effect<M, DrizzleMappingError, RSetup>;\n\nexport interface PasskeyCredentialServices {\n  readonly passkeyCredentials: PasskeyCredentials[\"Service\"];\n}\n\nexport interface PasskeyPersistenceServices {\n  readonly passkeyPersistence: PasskeyPersistence[\"Service\"];\n}\n\nexport interface PasskeyEnrollmentContextServices {\n  readonly passkeyEnrollmentContext: PasskeyEnrollmentContext[\"Service\"];\n}\n\nexport const passkeyCredentialsLayer = <E, R>(\n  services: Effect.Effect<PasskeyCredentialServices, E, R>,\n): Layer.Layer<PasskeyCredentials, E, R> =>\n  Layer.effect(\n    PasskeyCredentials,\n    Effect.map(services, (value) => value.passkeyCredentials),\n  );\n\nexport const passkeyPersistenceLayer = <E, R>(\n  services: Effect.Effect<PasskeyPersistenceServices, E, R>,\n): Layer.Layer<PasskeyPersistence, E, R> =>\n  Layer.effect(\n    PasskeyPersistence,\n    Effect.map(services, (value) => value.passkeyPersistence),\n  );\n\nexport const passkeyEnrollmentContextLayer = <E, R>(\n  services: Effect.Effect<PasskeyEnrollmentContextServices, E, R>,\n): Layer.Layer<PasskeyEnrollmentContext, E, R> =>\n  Layer.effect(\n    PasskeyEnrollmentContext,\n    Effect.map(services, (value) => value.passkeyEnrollmentContext),\n  );\n\n/** Native IDs roundtrip exactly; protocol IDs and authentication references are\n * different identities. These callbacks never suspend inside an owner. */\nexport interface PasskeySubjectIdCodec<N> {\n  readonly toNative: (id: SubjectId) => N;\n  readonly toSubject: (id: N) => SubjectId;\n  readonly equals: (left: N, right: N) => boolean;\n}\n\nexport interface PasskeyClock {\n  readonly encodeInstant: (millis: number) => unknown;\n  readonly decodeInstant: (value: unknown) => number;\n  readonly engineNowMillis: SQL;\n  readonly toMillis: (expression: SQL) => SQL;\n  readonly fromMillis: (expression: SQL) => SQL;\n}\n\nexport interface PasskeySubjectReadTable<T extends Table, N> {\n  readonly table: T;\n  readonly id: PasskeyColumn<T>;\n  readonly status: PasskeyColumn<T>;\n  readonly securityRevision: PasskeyColumn<T>;\n  readonly decodeId: (row: Readonly<Partial<InferSelectModel<T>>>) => N;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeCondition: SQL;\n}\n\nexport interface PasskeyFactorReadTable<T extends Table> {\n  readonly table: T;\n  readonly subjectId: PasskeyColumn<T>;\n  readonly credentialId: PasskeyColumn<T>;\n  readonly revision: PasskeyColumn<T>;\n  readonly status: PasskeyColumn<T>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeCondition: SQL;\n}\n\n/** decode uses only these declared columns. Counter columns are native integral\n * numbers; BS may use a consumer enum. Name/creation metadata is not required. */\nexport interface PasskeyCredentialReadTable<T extends Table, N> {\n  readonly table: T;\n  readonly credentialId: PasskeyColumn<T>;\n  readonly subjectId: PasskeyColumn<T>;\n  readonly rpId: PasskeyColumn<T>;\n  readonly protocolCredentialId: PasskeyColumn<T>;\n  readonly credentialKey: PasskeyColumn<T>;\n  readonly handleKey: PasskeyColumn<T>;\n  readonly userHandle: PasskeyColumn<T>;\n  readonly publicKey: PasskeyColumn<T>;\n  readonly algorithm: PasskeyColumn<T>;\n  readonly profile: PasskeyColumn<T>;\n  readonly credentialRevision: PasskeyColumn<T>;\n  readonly status: PasskeyColumn<T>;\n  readonly primarySignIn: PasskeyColumn<T>;\n  readonly enrollmentUserVerified: PasskeyColumn<T>;\n  readonly backupEligible: PasskeyColumn<T>;\n  readonly backupState: PasskeyColumn<T>;\n  readonly counter: PasskeyColumn<T>;\n  readonly maximumCounter: PasskeyColumn<T>;\n  readonly decode: (\n    row: Readonly<Partial<InferSelectModel<T>>>,\n  ) => Omit<PasskeyCredential, \"revision\" | \"active\">;\n  readonly decodeSubjectId: (row: Readonly<Partial<InferSelectModel<T>>>) => N;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeCondition: SQL;\n}\n\nexport interface PasskeyCredentialOwnershipTable<T extends Table, N> {\n  readonly table: T;\n  readonly credentialKey: PasskeyColumn<T>;\n  readonly rpId: PasskeyColumn<T>;\n  readonly protocolCredentialId: PasskeyColumn<T>;\n  readonly subjectId: PasskeyColumn<T>;\n  readonly credentialId: PasskeyColumn<T>;\n  readonly state: PasskeyColumn<T>;\n  readonly version: PasskeyColumn<T>;\n  readonly reservationId: PasskeyColumn<T>;\n  readonly ownedCondition: SQL;\n  readonly isOwnedState: (value: unknown) => boolean;\n  readonly decodeSubjectId: (row: Readonly<Partial<InferSelectModel<T>>>) => N;\n}\n\n/** Reservations do not manufacture a subject; bound handles are RP-global. */\nexport interface PasskeyHandleReadTable<T extends Table> {\n  readonly table: T;\n  readonly handleKey: PasskeyColumn<T>;\n  readonly rpId: PasskeyColumn<T>;\n  readonly userHandle: PasskeyColumn<T>;\n  readonly state: PasskeyColumn<T>;\n  readonly version: PasskeyColumn<T>;\n  readonly reservationId: PasskeyColumn<T>;\n}\n\nexport interface PasskeyHandleReservationTable<T extends Table> extends PasskeyHandleReadTable<T> {\n  readonly reservedCondition: SQL;\n  readonly isReservedState: (value: unknown) => boolean;\n}\n\nexport interface PasskeyHandleOwnershipTable<T extends Table, N> extends PasskeyHandleReadTable<T> {\n  readonly subjectId: PasskeyColumn<T>;\n  readonly ownedCondition: SQL;\n  readonly isOwnedState: (value: unknown) => boolean;\n  readonly decodeSubjectId: (row: Readonly<Partial<InferSelectModel<T>>>) => N;\n}\n\nexport const requiredPasskeyCredentialConstraints = {\n  credentialId: [\"credentialId\"],\n  factor: [\"subjectId\", \"credentialId\"],\n  credentialOwnership: [\"credentialKey\"],\n  handleOwnership: [\"handleKey\"],\n  boundSubjectHandle: [\"rpId\", \"subjectId\"],\n} as const;\n\nexport interface PasskeyCredentialMapping<\n  S extends Table,\n  C extends Table,\n  F extends Table,\n  Ownership extends Table,\n  Handle extends Table,\n  N,\n> {\n  readonly subject: PasskeySubjectReadTable<S, N>;\n  readonly credential: PasskeyCredentialReadTable<C, N>;\n  readonly authority: PasskeyFactorReadTable<F>;\n  readonly credentialOwnership: PasskeyCredentialOwnershipTable<Ownership, N>;\n  readonly handleOwnership: PasskeyHandleOwnershipTable<Handle, N>;\n  readonly subjectIds: PasskeySubjectIdCodec<N>;\n  readonly constraints: typeof requiredPasskeyCredentialConstraints;\n}\n\n/** A stable additional policy row, acquired before RP/credential locks. The\n * factory checks column names without erasing the consumer table at its input. */\nconst PasskeyPolicyGuardTypeId: unique symbol = Symbol(\"effect-auth/drizzle/PasskeyPolicyGuard\");\n\nexport interface PasskeyPolicyGuard {\n  readonly [PasskeyPolicyGuardTypeId]: true;\n  readonly scope: string;\n  readonly table: Table;\n  readonly columns: ReadonlyArray<string>;\n  readonly where: (moduleId: string) => SQL;\n  readonly condition: (moduleId: string) => SQL;\n}\n\nexport const passkeyPolicyGuard = <T extends Table>(input: {\n  readonly scope: string;\n  readonly table: T;\n  readonly columns: ReadonlyArray<PasskeyColumn<T>>;\n  readonly where: (moduleId: string) => SQL;\n  readonly condition: (moduleId: string) => SQL;\n}): PasskeyPolicyGuard => ({ ...input, [PasskeyPolicyGuardTypeId]: true });\n\nexport interface PasskeyModuleTable<T extends Table> {\n  readonly table: T;\n  readonly moduleId: PasskeyColumn<T>;\n  readonly status: PasskeyColumn<T>;\n  readonly policyRevision: PasskeyColumn<T>;\n  /** All physical fields used by decodeMethodPolicy, including policyRevision. */\n  readonly policyColumns: ReadonlyArray<PasskeyColumn<T>>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeCondition: SQL;\n  readonly decodeMethodPolicy: (row: Readonly<Partial<InferSelectModel<T>>>) => PasskeyMethodPolicy;\n  readonly guards?: ReadonlyArray<PasskeyPolicyGuard>;\n}\n\nexport type PasskeyFlowState =\n  | \"Pending\"\n  | \"Claimed\"\n  | \"Verified\"\n  | \"Rejected\"\n  | \"Ambiguous\"\n  | \"RegistrationAccepted\"\n  | \"ProvisioningPending\";\n\nexport interface PasskeyFlowInsert {\n  readonly ceremony: PasskeyCeremony;\n  readonly policy: PasskeyMethodPolicy;\n  readonly marker: string;\n}\n\nexport interface PasskeyFlowTable<T extends Table> {\n  readonly table: T;\n  readonly moduleId: PasskeyColumn<T>;\n  readonly flowId: PasskeyColumn<T>;\n  readonly commandId: PasskeyColumn<T>;\n  readonly purpose: PasskeyColumn<T>;\n  readonly state: PasskeyColumn<T>;\n  readonly version: PasskeyColumn<T>;\n  readonly generation: PasskeyColumn<T>;\n  readonly snapshot: PasskeyColumn<T>;\n  readonly policySnapshot: PasskeyColumn<T>;\n  readonly requestBindingVerifier: PasskeyColumn<T>;\n  readonly requestBindingExpiresAt: PasskeyColumn<T>;\n  readonly issuedAt: PasskeyColumn<T>;\n  readonly expiresAt: PasskeyColumn<T>;\n  readonly retentionUntil: PasskeyColumn<T>;\n  readonly claimId: PasskeyColumn<T>;\n  readonly claimedAt: PasskeyColumn<T>;\n  readonly claimExpiresAt: PasskeyColumn<T>;\n  readonly credentialSnapshot: PasskeyColumn<T>;\n  /** Core SubjectId scope text, not a consumer's native subject ID. */\n  readonly subjectScope: PasskeyColumn<T>;\n  readonly targetScope: PasskeyColumn<T>;\n  readonly states: Readonly<Record<PasskeyFlowState, unknown>>;\n  readonly encodeInsert: (input: PasskeyFlowInsert) => InferInsertModel<T>;\n}\n\nexport interface PasskeyAdmissionTable<T extends Table> {\n  readonly table: T;\n  readonly authorityScope: PasskeyColumn<T>;\n  readonly moduleId: PasskeyColumn<T>;\n  readonly version: PasskeyColumn<T>;\n  readonly ownerMarker: PasskeyColumn<T>;\n  /** One physical clock sample, reused by every charge of this decision. */\n  readonly admittedAt: PasskeyColumn<T>;\n}\n\nexport type PasskeyChargeKind = \"global\" | \"subject\" | \"target\";\n\nexport interface PasskeyChargeInsert {\n  readonly moduleId: string;\n  readonly flowId: string;\n  readonly purpose: PasskeyCeremony[\"purpose\"];\n  readonly kind: PasskeyChargeKind;\n  readonly scope: string;\n  readonly originalWindowMillis: number;\n  readonly marker: string;\n}\n\n/** Charge scope is canonical core identity text; this subject-free descriptor\n * can count all purposes without decoding any unrelated native subject. */\nexport interface PasskeyChargeTable<T extends Table> {\n  readonly table: T;\n  readonly moduleId: PasskeyColumn<T>;\n  readonly flowId: PasskeyColumn<T>;\n  readonly purpose: PasskeyColumn<T>;\n  readonly kind: PasskeyColumn<T>;\n  readonly scope: PasskeyColumn<T>;\n  readonly originalWindowMillis: PasskeyColumn<T>;\n  readonly admittedAt: PasskeyColumn<T>;\n  readonly retainUntil: PasskeyColumn<T>;\n  readonly version: PasskeyColumn<T>;\n  readonly ownerMarker: PasskeyColumn<T>;\n  readonly encodeInsert: (input: PasskeyChargeInsert) => InferInsertModel<T>;\n}\n\nexport const requiredPasskeyPersistenceConstraints = {\n  flow: [\"moduleId\", \"flowId\"],\n  command: [\"moduleId\", \"commandId\"],\n  admission: [\"authorityScope\", \"moduleId\"],\n  charge: [\"moduleId\", \"flowId\", \"kind\"],\n} as const;\n\nexport interface PasskeyCeremonyMapping<\n  Module extends Table,\n  Flow extends Table,\n  Admission extends Table,\n  Charge extends Table,\n> {\n  readonly moduleId: string;\n  readonly authorityScope: string;\n  readonly module: PasskeyModuleTable<Module>;\n  readonly flow: PasskeyFlowTable<Flow>;\n  readonly admission: PasskeyAdmissionTable<Admission>;\n  readonly charge: PasskeyChargeTable<Charge>;\n  readonly clock: PasskeyClock;\n  readonly constraints: typeof requiredPasskeyPersistenceConstraints;\n}\n\ntype CredentialTable<Read> = Read extends {\n  readonly credential: { readonly table: infer T extends Table };\n}\n  ? T\n  : never;\n\nexport interface PasskeyPersistenceMapping<\n  Read,\n  Module extends Table,\n  Flow extends Table,\n  Admission extends Table,\n  Charge extends Table,\n  N,\n> extends PasskeyCeremonyMapping<Module, Flow, Admission, Charge> {\n  readonly read: Read & { readonly subjectIds: PasskeySubjectIdCodec<N> };\n  readonly telemetry: {\n    readonly lastUsedAt: PasskeyColumn<CredentialTable<Read>>;\n    readonly encodeBackupState: (value: boolean) => unknown;\n  };\n}\n\nexport interface PasskeyEnrollmentContextMapping<Read, Module extends Table, N> {\n  readonly moduleId: string;\n  readonly read: Read & { readonly subjectIds: PasskeySubjectIdCodec<N> };\n  readonly module: PasskeyModuleTable<Module>;\n}\n\nexport interface D1PasskeyMapping {\n  readonly d1: { readonly primary: true };\n}\n"],"mappings":";;;;;AA6BA,MAAa,2BACX,aAEA,MAAM,OACJ,oBACA,OAAO,IAAI,WAAW,UAAU,MAAM,kBAAkB,CAC1D;AAEF,MAAa,2BACX,aAEA,MAAM,OACJ,oBACA,OAAO,IAAI,WAAW,UAAU,MAAM,kBAAkB,CAC1D;AAEF,MAAa,iCACX,aAEA,MAAM,OACJ,0BACA,OAAO,IAAI,WAAW,UAAU,MAAM,wBAAwB,CAChE;AA0GF,MAAa,uCAAuC;CAClD,cAAc,CAAC,cAAc;CAC7B,QAAQ,CAAC,aAAa,cAAc;CACpC,qBAAqB,CAAC,eAAe;CACrC,iBAAiB,CAAC,WAAW;CAC7B,oBAAoB,CAAC,QAAQ,WAAW;AAC1C;;;AAqBA,MAAM,2BAA0C,OAAO,wCAAwC;AAW/F,MAAa,sBAAuC,WAMzB;CAAE,GAAG;EAAQ,2BAA2B;AAAK;AAgGxE,MAAa,wCAAwC;CACnD,MAAM,CAAC,YAAY,QAAQ;CAC3B,SAAS,CAAC,YAAY,WAAW;CACjC,WAAW,CAAC,kBAAkB,UAAU;CACxC,QAAQ;EAAC;EAAY;EAAU;CAAM;AACvC"}

package/dist/drizzle/passkey-registration-ceremony-model.d.mts

@@ -0,0 +1,50 @@
+import { PasskeyCeremonyMapping, PasskeyChargeTable, PasskeyColumn, PasskeyFlowTable, PasskeyHandleReservationTable, PasskeyPersistenceServices } from "./passkey-model.mjs";
+import { SQL, Table } from "drizzle-orm";
+//#region src/drizzle/passkey-registration-ceremony-model.d.ts
+interface PasskeyRegistrationCeremonyCapabilities {
+  readonly purposes: readonly ["registration"];
+  readonly issue: "registration-authority";
+  readonly assertionSettlement: false;
+}
+interface PasskeyRegistrationCeremonyServices extends PasskeyPersistenceServices {
+  readonly capabilities: PasskeyRegistrationCeremonyCapabilities;
+}
+/** Read-only custody supplied by a separate registration issuance authority.
+ * No application payload codec, subject codec or provisioning callback runs here. */
+interface PasskeyRegistrationIntentReadTable<T extends Table> {
+  readonly table: T;
+  readonly moduleId: PasskeyColumn<T>;
+  readonly flowId: PasskeyColumn<T>;
+  readonly commandId: PasskeyColumn<T>;
+  readonly state: PasskeyColumn<T>;
+  readonly version: PasskeyColumn<T>;
+  readonly fingerprint: PasskeyColumn<T>;
+  readonly handleKey: PasskeyColumn<T>;
+  readonly reservationId: PasskeyColumn<T>;
+  readonly ceremonySnapshot: PasskeyColumn<T>;
+  /** Already validated by the issuing authority; compare opaque bytes only. */
+  readonly applicationSnapshot: PasskeyColumn<T>;
+  readonly pendingCondition: SQL;
+  readonly isPendingState: (value: unknown) => boolean;
+  /** Any unresolved initial intent or provisioning job; cleanup never releases it. */
+  readonly custodyCondition: SQL;
+}
+declare const requiredPasskeyRegistrationCeremonyConstraints: {
+  readonly flow: readonly ["moduleId", "flowId"];
+  readonly command: readonly ["moduleId", "commandId"];
+  readonly admission: readonly ["authorityScope", "moduleId"];
+  readonly charge: readonly ["moduleId", "flowId", "kind"];
+  readonly intentFlow: readonly ["moduleId", "flowId"];
+  readonly intentCommand: readonly ["moduleId", "commandId"];
+  readonly handle: readonly ["handleKey"];
+};
+interface PasskeyRegistrationCeremonyMapping<Module extends Table, Flow extends Table, Admission extends Table, Charge extends Table, Intent extends Table, Handle extends Table> extends Omit<PasskeyCeremonyMapping<Module, Flow, Admission, Charge>, "constraints" | "flow" | "charge"> {
+  readonly flow: Omit<PasskeyFlowTable<Flow>, "encodeInsert">;
+  readonly charge: Omit<PasskeyChargeTable<Charge>, "encodeInsert">;
+  readonly intent: PasskeyRegistrationIntentReadTable<Intent>;
+  readonly handle: PasskeyHandleReservationTable<Handle>;
+  readonly constraints: typeof requiredPasskeyRegistrationCeremonyConstraints;
+}
+//#endregion
+export { PasskeyRegistrationCeremonyCapabilities, PasskeyRegistrationCeremonyMapping, PasskeyRegistrationCeremonyServices, PasskeyRegistrationIntentReadTable, requiredPasskeyRegistrationCeremonyConstraints };
+//# sourceMappingURL=passkey-registration-ceremony-model.d.mts.map

package/dist/drizzle/passkey-registration-ceremony-model.mjs

@@ -0,0 +1,18 @@
+//#region src/drizzle/passkey-registration-ceremony-model.ts
+const requiredPasskeyRegistrationCeremonyConstraints = {
+	flow: ["moduleId", "flowId"],
+	command: ["moduleId", "commandId"],
+	admission: ["authorityScope", "moduleId"],
+	charge: [
+		"moduleId",
+		"flowId",
+		"kind"
+	],
+	intentFlow: ["moduleId", "flowId"],
+	intentCommand: ["moduleId", "commandId"],
+	handle: ["handleKey"]
+};
+//#endregion
+export { requiredPasskeyRegistrationCeremonyConstraints };
+
+//# sourceMappingURL=passkey-registration-ceremony-model.mjs.map

package/dist/drizzle/passkey-registration-ceremony-model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-registration-ceremony-model.mjs","names":[],"sources":["../../src/drizzle/passkey-registration-ceremony-model.ts"],"sourcesContent":["import type { SQL, Table } from \"drizzle-orm\";\n\nimport type {\n  PasskeyCeremonyMapping,\n  PasskeyChargeTable,\n  PasskeyColumn,\n  PasskeyFlowTable,\n  PasskeyHandleReservationTable,\n  PasskeyPersistenceServices,\n} from \"./passkey-model\";\n\nexport interface PasskeyRegistrationCeremonyCapabilities {\n  readonly purposes: readonly [\"registration\"];\n  readonly issue: \"registration-authority\";\n  readonly assertionSettlement: false;\n}\n\nexport interface PasskeyRegistrationCeremonyServices extends PasskeyPersistenceServices {\n  readonly capabilities: PasskeyRegistrationCeremonyCapabilities;\n}\n\n/** Read-only custody supplied by a separate registration issuance authority.\n * No application payload codec, subject codec or provisioning callback runs here. */\nexport interface PasskeyRegistrationIntentReadTable<T extends Table> {\n  readonly table: T;\n  readonly moduleId: PasskeyColumn<T>;\n  readonly flowId: PasskeyColumn<T>;\n  readonly commandId: PasskeyColumn<T>;\n  readonly state: PasskeyColumn<T>;\n  readonly version: PasskeyColumn<T>;\n  readonly fingerprint: PasskeyColumn<T>;\n  readonly handleKey: PasskeyColumn<T>;\n  readonly reservationId: PasskeyColumn<T>;\n  readonly ceremonySnapshot: PasskeyColumn<T>;\n  /** Already validated by the issuing authority; compare opaque bytes only. */\n  readonly applicationSnapshot: PasskeyColumn<T>;\n  readonly pendingCondition: SQL;\n  readonly isPendingState: (value: unknown) => boolean;\n  /** Any unresolved initial intent or provisioning job; cleanup never releases it. */\n  readonly custodyCondition: SQL;\n}\n\nexport const requiredPasskeyRegistrationCeremonyConstraints = {\n  flow: [\"moduleId\", \"flowId\"],\n  command: [\"moduleId\", \"commandId\"],\n  admission: [\"authorityScope\", \"moduleId\"],\n  charge: [\"moduleId\", \"flowId\", \"kind\"],\n  intentFlow: [\"moduleId\", \"flowId\"],\n  intentCommand: [\"moduleId\", \"commandId\"],\n  handle: [\"handleKey\"],\n} as const;\n\nexport interface PasskeyRegistrationCeremonyMapping<\n  Module extends Table,\n  Flow extends Table,\n  Admission extends Table,\n  Charge extends Table,\n  Intent extends Table,\n  Handle extends Table,\n> extends Omit<\n  PasskeyCeremonyMapping<Module, Flow, Admission, Charge>,\n  \"constraints\" | \"flow\" | \"charge\"\n> {\n  readonly flow: Omit<PasskeyFlowTable<Flow>, \"encodeInsert\">;\n  readonly charge: Omit<PasskeyChargeTable<Charge>, \"encodeInsert\">;\n  readonly intent: PasskeyRegistrationIntentReadTable<Intent>;\n  readonly handle: PasskeyHandleReservationTable<Handle>;\n  readonly constraints: typeof requiredPasskeyRegistrationCeremonyConstraints;\n}\n"],"mappings":";AA0CA,MAAa,iDAAiD;CAC5D,MAAM,CAAC,YAAY,QAAQ;CAC3B,SAAS,CAAC,YAAY,WAAW;CACjC,WAAW,CAAC,kBAAkB,UAAU;CACxC,QAAQ;EAAC;EAAY;EAAU;CAAM;CACrC,YAAY,CAAC,YAAY,QAAQ;CACjC,eAAe,CAAC,YAAY,WAAW;CACvC,QAAQ,CAAC,WAAW;AACtB"}

package/dist/drizzle/passkey-registration-ceremony.mjs

@@ -0,0 +1,124 @@
+import { both } from "./transaction-owner.mjs";
+import { PasskeyClaim } from "../passkey/models.mjs";
+import { snapshotPasskeySync } from "../passkey/snapshot.mjs";
+import { CurrentPasskeyTransaction, ceremonyStorage, equal, handleKey, invariant, mappedColumns, policyStorage } from "./passkey-state.mjs";
+import { admissionCondition, guardAdmission, guardChargeSet, lockAdmission, readCharges } from "./passkey-admission.mjs";
+import { readModule, readPolicyGuards } from "./passkey-credentials.mjs";
+import { releaseRegistrationCustody } from "./passkey-registration-custody.mjs";
+import { compatiblePolicy, liveCondition, matchesAccess, readFlow, terminalFlow } from "./passkey-flow.mjs";
+import { Effect } from "effect";
+import { sql } from "drizzle-orm";
+//#region src/drizzle/passkey-registration-ceremony.ts
+/** The issuing registration authority owns the application value and reservation.
+* This facet only compares its opaque custody and cannot issue or provision. */
+const custody = Effect.fn("passkey.registrationCustody")(function* (mapping, ceremony, pending) {
+	const owner = yield* CurrentPasskeyTransaction;
+	invariant(ceremony.context._tag === "Registration");
+	const context = ceremony.context, intent = mapping.intent, handle = mapping.handle;
+	const identity = {
+		[intent.moduleId]: mapping.moduleId,
+		[intent.flowId]: ceremony.flowId
+	};
+	const advisory = (yield* owner.read(intent.table, equal(intent.table, identity), {
+		limit: 1,
+		lock: false,
+		observe: false
+	})).rows[0];
+	if (advisory === void 0) return false;
+	const hashedHandle = handleKey(ceremony.profile.rpId, context.userHandle);
+	const held = (yield* owner.read(handle.table, equal(handle.table, { [handle.handleKey]: hashedHandle }), {
+		limit: 1,
+		columns: mappedColumns(handle)
+	})).rows[0];
+	if (held === void 0 || !handle.isReservedState(held[handle.state]) || held[handle.handleKey] !== hashedHandle || held[handle.rpId] !== ceremony.profile.rpId || held[handle.userHandle] !== context.userHandle || held[handle.reservationId] !== advisory[intent.reservationId]) return false;
+	const heldCondition = sql`exists (select 1 from ${handle.table} where ${both(owner.exact(handle.table, held), handle.reservedCondition)})`;
+	if (!(yield* owner.check(heldCondition))) return false;
+	const row = (yield* owner.read(intent.table, equal(intent.table, identity), {
+		limit: 1,
+		columns: mappedColumns(intent)
+	})).rows[0];
+	if (row === void 0 || row[intent.commandId] !== ceremony.commandId || row[intent.fingerprint] !== context.fingerprint || row[intent.handleKey] !== hashedHandle || row[intent.reservationId] !== held[handle.reservationId] || row[intent.ceremonySnapshot] !== ceremonyStorage.encode(ceremony) || typeof row[intent.applicationSnapshot] !== "string" || new TextEncoder().encode(row[intent.applicationSnapshot]).length > 1048576 || pending && !intent.isPendingState(row[intent.state])) return false;
+	const condition = pending ? intent.pendingCondition : intent.custodyCondition;
+	if (!(yield* owner.check(sql`exists (select 1 from ${intent.table} where ${both(owner.exact(intent.table, row), condition)})`))) return false;
+	return [heldCondition, sql`exists (select 1 from ${intent.table} where ${both(owner.exact(intent.table, row), condition)})`];
+});
+const contextRegistration = Effect.fn("passkey.contextRegistration")(function* (mapping, access) {
+	const owner = yield* CurrentPasskeyTransaction;
+	if (access.moduleId !== mapping.moduleId) return void 0;
+	const current = yield* readModule(mapping);
+	if (current === void 0) return void 0;
+	yield* readPolicyGuards(mapping);
+	const table = mapping.flow;
+	const advisory = (yield* owner.read(table.table, equal(table.table, {
+		[table.moduleId]: mapping.moduleId,
+		[table.flowId]: access.flowId
+	}), {
+		limit: 1,
+		lock: false,
+		observe: false
+	})).rows[0];
+	if (advisory === void 0) return void 0;
+	const ceremony = ceremonyStorage.decode(advisory[table.snapshot]);
+	if (ceremony.purpose !== "registration" || !matchesAccess(ceremony, access)) return void 0;
+	const held = yield* custody(mapping, ceremony, true);
+	if (!held) return void 0;
+	const read = yield* readFlow(mapping, access.flowId);
+	if (read === void 0 || read.state !== "Pending" || ceremonyStorage.encode(read.ceremony) !== ceremonyStorage.encode(ceremony) || !compatiblePolicy(read.ceremony, read.policy, current) || !(yield* owner.check(liveCondition(mapping, ceremony)))) return void 0;
+	owner.postconditions.push(...held, liveCondition(mapping, ceremony));
+	return read.ceremony;
+});
+const claimRegistration = Effect.fn("passkey.claimRegistration")(function* (mapping, input) {
+	const owner = yield* CurrentPasskeyTransaction;
+	const current = yield* readModule(mapping);
+	if (current === void 0 || input.access.moduleId !== mapping.moduleId) return { _tag: "Rejected" };
+	yield* lockAdmission(mapping);
+	yield* readPolicyGuards(mapping);
+	const held = yield* custody(mapping, input.ceremony, true);
+	const read = yield* readFlow(mapping, input.access.flowId);
+	if (read === void 0 || read.state !== "Pending" || !matchesAccess(read.ceremony, input.access)) return { _tag: "Rejected" };
+	invariant(ceremonyStorage.encode(read.ceremony) === ceremonyStorage.encode(input.ceremony));
+	if (!held || !compatiblePolicy(read.ceremony, read.policy, current) || policyStorage.encode(current) !== policyStorage.encode(input.policy) || !(yield* owner.check(liveCondition(mapping, read.ceremony))) || !(yield* owner.check(admissionCondition(mapping, [read.policy, current], read.ceremony, void 0, [], false, false)))) {
+		if (held) yield* releaseRegistrationCustody(mapping, read.ceremony);
+		yield* terminalFlow(mapping, read, "Rejected");
+		return { _tag: "Rejected" };
+	}
+	yield* readCharges(mapping, read.ceremony, read.policy, void 0);
+	const claimedAtMillis = yield* owner.now(mapping.clock);
+	const claim = snapshotPasskeySync(PasskeyClaim, {
+		ceremony: read.ceremony,
+		claimId: input.claimId,
+		claimedAtMillis,
+		claimExpiresAtMillis: Math.min(claimedAtMillis + read.ceremony.claimLifetimeMillis, read.ceremony.expiresAtMillis)
+	});
+	const table = mapping.flow;
+	yield* owner.update(table.table, {
+		[table.moduleId]: mapping.moduleId,
+		[table.flowId]: read.ceremony.flowId
+	}, {
+		[table.state]: table.states.Claimed,
+		[table.version]: owner.marker,
+		[table.claimId]: claim.claimId,
+		[table.claimedAt]: mapping.clock.encodeInstant(claim.claimedAtMillis),
+		[table.claimExpiresAt]: mapping.clock.encodeInstant(claim.claimExpiresAtMillis)
+	});
+	yield* guardChargeSet(mapping, read.ceremony, void 0);
+	yield* guardAdmission(mapping, [read.policy, current], read.ceremony, void 0);
+	owner.postconditions.push(...held, liveCondition(mapping, read.ceremony, claim));
+	return {
+		_tag: "Claimed",
+		claim
+	};
+});
+const settleRegistration = Effect.fn("passkey.settleRegistration")(function* (mapping, claim, outcome) {
+	yield* readModule(mapping);
+	yield* lockAdmission(mapping);
+	yield* readPolicyGuards(mapping);
+	const read = yield* readFlow(mapping, claim.ceremony.flowId);
+	if (read === void 0 || read.state !== "Claimed" || read.claim === void 0 || read.claim.claimId !== claim.claimId || read.claim.claimedAtMillis !== claim.claimedAtMillis || read.claim.claimExpiresAtMillis !== claim.claimExpiresAtMillis || ceremonyStorage.encode(read.ceremony) !== ceremonyStorage.encode(claim.ceremony)) return "Rejected";
+	if (outcome === "Rejected") yield* releaseRegistrationCustody(mapping, claim.ceremony);
+	return yield* terminalFlow(mapping, read, outcome);
+});
+//#endregion
+export { claimRegistration, contextRegistration, settleRegistration };
+
+//# sourceMappingURL=passkey-registration-ceremony.mjs.map

package/dist/drizzle/passkey-registration-ceremony.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-registration-ceremony.mjs","names":[],"sources":["../../src/drizzle/passkey-registration-ceremony.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- private mapped-row kernel; public descriptors retain concrete tables. */\nimport { sql } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport { PasskeyClaim, type PasskeyAccess, type PasskeyCeremony } from \"../passkey/models\";\nimport type { PasskeyMethodPolicy } from \"../passkey/policy\";\nimport { snapshotPasskeySync } from \"../passkey/snapshot\";\nimport {\n  admissionCondition,\n  guardAdmission,\n  guardChargeSet,\n  lockAdmission,\n  readCharges,\n} from \"./passkey-admission\";\nimport { readModule, readPolicyGuards } from \"./passkey-credentials\";\nimport {\n  compatiblePolicy,\n  liveCondition,\n  matchesAccess,\n  readFlow,\n  terminalFlow,\n} from \"./passkey-flow\";\nimport { releaseRegistrationCustody } from \"./passkey-registration-custody\";\nimport {\n  ceremonyStorage,\n  equal,\n  handleKey,\n  invariant,\n  mappedColumns,\n  policyStorage,\n  CurrentPasskeyTransaction,\n} from \"./passkey-state\";\nimport { both } from \"./transaction-owner\";\n\n/** The issuing registration authority owns the application value and reservation.\n * This facet only compares its opaque custody and cannot issue or provision. */\nconst custody = Effect.fn(\"passkey.registrationCustody\")(function* (\n  mapping: any,\n  ceremony: PasskeyCeremony,\n  pending: boolean,\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n\n  invariant(ceremony.context._tag === \"Registration\");\n\n  const context = ceremony.context,\n    intent = mapping.intent,\n    handle = mapping.handle;\n\n  const identity = { [intent.moduleId]: mapping.moduleId, [intent.flowId]: ceremony.flowId };\n\n  const advisory = (yield* owner.read(intent.table, equal(intent.table, identity), {\n    limit: 1,\n    lock: false,\n    observe: false,\n  })).rows[0];\n\n  if (advisory === undefined) return false;\n  const hashedHandle = handleKey(ceremony.profile.rpId, context.userHandle);\n\n  const held = (yield* owner.read(\n    handle.table,\n    equal(handle.table, { [handle.handleKey]: hashedHandle }),\n    { limit: 1, columns: mappedColumns(handle) },\n  )).rows[0];\n\n  if (\n    held === undefined ||\n    !handle.isReservedState(held[handle.state]) ||\n    held[handle.handleKey] !== hashedHandle ||\n    held[handle.rpId] !== ceremony.profile.rpId ||\n    held[handle.userHandle] !== context.userHandle ||\n    held[handle.reservationId] !== advisory[intent.reservationId]\n  )\n    return false;\n  const heldCondition = sql`exists (select 1 from ${handle.table} where ${both(owner.exact(handle.table, held), handle.reservedCondition)})`;\n\n  if (!(yield* owner.check(heldCondition))) return false;\n\n  const row = (yield* owner.read(intent.table, equal(intent.table, identity), {\n    limit: 1,\n    columns: mappedColumns(intent),\n  })).rows[0];\n\n  if (\n    row === undefined ||\n    row[intent.commandId] !== ceremony.commandId ||\n    row[intent.fingerprint] !== context.fingerprint ||\n    row[intent.handleKey] !== hashedHandle ||\n    row[intent.reservationId] !== held[handle.reservationId] ||\n    row[intent.ceremonySnapshot] !== ceremonyStorage.encode(ceremony) ||\n    typeof row[intent.applicationSnapshot] !== \"string\" ||\n    new TextEncoder().encode(row[intent.applicationSnapshot]).length > 1048576 ||\n    (pending && !intent.isPendingState(row[intent.state]))\n  )\n    return false;\n  const condition = pending ? intent.pendingCondition : intent.custodyCondition;\n\n  if (\n    !(yield* owner.check(\n      sql`exists (select 1 from ${intent.table} where ${both(owner.exact(intent.table, row), condition)})`,\n    ))\n  )\n    return false;\n\n  return [\n    heldCondition,\n    sql`exists (select 1 from ${intent.table} where ${both(owner.exact(intent.table, row), condition)})`,\n  ];\n});\n\nexport const contextRegistration = Effect.fn(\"passkey.contextRegistration\")(function* (\n  mapping: any,\n  access: PasskeyAccess,\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n\n  if (access.moduleId !== mapping.moduleId) return undefined;\n  const current = yield* readModule(mapping);\n\n  if (current === undefined) return undefined;\n  yield* readPolicyGuards(mapping);\n  const table = mapping.flow;\n\n  const advisory = (yield* owner.read(\n    table.table,\n    equal(table.table, { [table.moduleId]: mapping.moduleId, [table.flowId]: access.flowId }),\n    { limit: 1, lock: false, observe: false },\n  )).rows[0];\n\n  if (advisory === undefined) return undefined;\n  const ceremony = ceremonyStorage.decode(advisory[table.snapshot]);\n\n  if (ceremony.purpose !== \"registration\" || !matchesAccess(ceremony, access)) return undefined;\n  const held = yield* custody(mapping, ceremony, true);\n\n  if (!held) return undefined;\n  const read = yield* readFlow(mapping, access.flowId);\n\n  if (\n    read === undefined ||\n    read.state !== \"Pending\" ||\n    ceremonyStorage.encode(read.ceremony) !== ceremonyStorage.encode(ceremony) ||\n    !compatiblePolicy(read.ceremony, read.policy, current) ||\n    !(yield* owner.check(liveCondition(mapping, ceremony)))\n  )\n    return undefined;\n  owner.postconditions.push(...held, liveCondition(mapping, ceremony));\n\n  return read.ceremony;\n});\n\nexport const claimRegistration = Effect.fn(\"passkey.claimRegistration\")(function* (\n  mapping: any,\n  input: {\n    readonly access: PasskeyAccess;\n    readonly policy: PasskeyMethodPolicy;\n    readonly ceremony: PasskeyCeremony;\n    readonly claimId: string;\n  },\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n  const current = yield* readModule(mapping);\n\n  if (current === undefined || input.access.moduleId !== mapping.moduleId)\n    return { _tag: \"Rejected\" } as const;\n  yield* lockAdmission(mapping);\n  yield* readPolicyGuards(mapping);\n  const held = yield* custody(mapping, input.ceremony, true);\n  const read = yield* readFlow(mapping, input.access.flowId);\n\n  if (read === undefined || read.state !== \"Pending\" || !matchesAccess(read.ceremony, input.access))\n    return { _tag: \"Rejected\" } as const;\n  invariant(ceremonyStorage.encode(read.ceremony) === ceremonyStorage.encode(input.ceremony));\n  if (\n    !held ||\n    !compatiblePolicy(read.ceremony, read.policy, current) ||\n    policyStorage.encode(current) !== policyStorage.encode(input.policy) ||\n    !(yield* owner.check(liveCondition(mapping, read.ceremony))) ||\n    !(yield* owner.check(\n      admissionCondition(\n        mapping,\n        [read.policy, current],\n        read.ceremony,\n        undefined,\n        [],\n        false,\n        false,\n      ),\n    ))\n  ) {\n    if (held) yield* releaseRegistrationCustody(mapping, read.ceremony);\n    yield* terminalFlow(mapping, read, \"Rejected\");\n\n    return { _tag: \"Rejected\" } as const;\n  }\n  yield* readCharges(mapping, read.ceremony, read.policy, undefined);\n  const claimedAtMillis = yield* owner.now(mapping.clock);\n\n  const claim = snapshotPasskeySync(PasskeyClaim, {\n    ceremony: read.ceremony,\n    claimId: input.claimId,\n    claimedAtMillis,\n    claimExpiresAtMillis: Math.min(\n      claimedAtMillis + read.ceremony.claimLifetimeMillis,\n      read.ceremony.expiresAtMillis,\n    ),\n  });\n\n  const table = mapping.flow;\n\n  yield* owner.update(\n    table.table,\n    { [table.moduleId]: mapping.moduleId, [table.flowId]: read.ceremony.flowId },\n    {\n      [table.state]: table.states.Claimed,\n      [table.version]: owner.marker,\n      [table.claimId]: claim.claimId,\n      [table.claimedAt]: mapping.clock.encodeInstant(claim.claimedAtMillis),\n      [table.claimExpiresAt]: mapping.clock.encodeInstant(claim.claimExpiresAtMillis),\n    },\n  );\n  yield* guardChargeSet(mapping, read.ceremony, undefined);\n  yield* guardAdmission(mapping, [read.policy, current], read.ceremony, undefined);\n  owner.postconditions.push(...held, liveCondition(mapping, read.ceremony, claim));\n\n  return { _tag: \"Claimed\", claim } as const;\n});\n\nexport const settleRegistration = Effect.fn(\"passkey.settleRegistration\")(function* (\n  mapping: any,\n  claim: PasskeyClaim,\n  outcome: \"Rejected\" | \"Ambiguous\",\n) {\n  yield* readModule(mapping);\n  yield* lockAdmission(mapping);\n  yield* readPolicyGuards(mapping);\n  const read = yield* readFlow(mapping, claim.ceremony.flowId);\n\n  if (\n    read === undefined ||\n    read.state !== \"Claimed\" ||\n    read.claim === undefined ||\n    read.claim.claimId !== claim.claimId ||\n    read.claim.claimedAtMillis !== claim.claimedAtMillis ||\n    read.claim.claimExpiresAtMillis !== claim.claimExpiresAtMillis ||\n    ceremonyStorage.encode(read.ceremony) !== ceremonyStorage.encode(claim.ceremony)\n  )\n    return \"Rejected\" as const;\n\n  if (outcome === \"Rejected\") yield* releaseRegistrationCustody(mapping, claim.ceremony);\n\n  return yield* terminalFlow(mapping, read, outcome);\n});\n"],"mappings":";;;;;;;;;;;;;AAoCA,MAAM,UAAU,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACvD,SACA,UACA,SACA;CACA,MAAM,QAAQ,OAAO;CAErB,UAAU,SAAS,QAAQ,SAAS,cAAc;CAElD,MAAM,UAAU,SAAS,SACvB,SAAS,QAAQ,QACjB,SAAS,QAAQ;CAEnB,MAAM,WAAW;GAAG,OAAO,WAAW,QAAQ;GAAW,OAAO,SAAS,SAAS;CAAO;CAEzF,MAAM,YAAY,OAAO,MAAM,KAAK,OAAO,OAAO,MAAM,OAAO,OAAO,QAAQ,GAAG;EAC/E,OAAO;EACP,MAAM;EACN,SAAS;CACX,CAAC,EAAA,CAAG,KAAK;CAET,IAAI,aAAa,KAAA,GAAW,OAAO;CACnC,MAAM,eAAe,UAAU,SAAS,QAAQ,MAAM,QAAQ,UAAU;CAExE,MAAM,QAAQ,OAAO,MAAM,KACzB,OAAO,OACP,MAAM,OAAO,OAAO,GAAG,OAAO,YAAY,aAAa,CAAC,GACxD;EAAE,OAAO;EAAG,SAAS,cAAc,MAAM;CAAE,CAC7C,EAAA,CAAG,KAAK;CAER,IACE,SAAS,KAAA,KACT,CAAC,OAAO,gBAAgB,KAAK,OAAO,MAAM,KAC1C,KAAK,OAAO,eAAe,gBAC3B,KAAK,OAAO,UAAU,SAAS,QAAQ,QACvC,KAAK,OAAO,gBAAgB,QAAQ,cACpC,KAAK,OAAO,mBAAmB,SAAS,OAAO,gBAE/C,OAAO;CACT,MAAM,gBAAgB,GAAG,yBAAyB,OAAO,MAAM,SAAS,KAAK,MAAM,MAAM,OAAO,OAAO,IAAI,GAAG,OAAO,iBAAiB,EAAE;CAExI,IAAI,EAAE,OAAO,MAAM,MAAM,aAAa,IAAI,OAAO;CAEjD,MAAM,OAAO,OAAO,MAAM,KAAK,OAAO,OAAO,MAAM,OAAO,OAAO,QAAQ,GAAG;EAC1E,OAAO;EACP,SAAS,cAAc,MAAM;CAC/B,CAAC,EAAA,CAAG,KAAK;CAET,IACE,QAAQ,KAAA,KACR,IAAI,OAAO,eAAe,SAAS,aACnC,IAAI,OAAO,iBAAiB,QAAQ,eACpC,IAAI,OAAO,eAAe,gBAC1B,IAAI,OAAO,mBAAmB,KAAK,OAAO,kBAC1C,IAAI,OAAO,sBAAsB,gBAAgB,OAAO,QAAQ,KAChE,OAAO,IAAI,OAAO,yBAAyB,YAC3C,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI,OAAO,oBAAoB,CAAC,CAAC,SAAS,WAClE,WAAW,CAAC,OAAO,eAAe,IAAI,OAAO,MAAM,GAEpD,OAAO;CACT,MAAM,YAAY,UAAU,OAAO,mBAAmB,OAAO;CAE7D,IACE,EAAE,OAAO,MAAM,MACb,GAAG,yBAAyB,OAAO,MAAM,SAAS,KAAK,MAAM,MAAM,OAAO,OAAO,GAAG,GAAG,SAAS,EAAE,EACpG,IAEA,OAAO;CAET,OAAO,CACL,eACA,GAAG,yBAAyB,OAAO,MAAM,SAAS,KAAK,MAAM,MAAM,OAAO,OAAO,GAAG,GAAG,SAAS,EAAE,EACpG;AACF,CAAC;AAED,MAAa,sBAAsB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC1E,SACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,IAAI,OAAO,aAAa,QAAQ,UAAU,OAAO,KAAA;CACjD,MAAM,UAAU,OAAO,WAAW,OAAO;CAEzC,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;CAClC,OAAO,iBAAiB,OAAO;CAC/B,MAAM,QAAQ,QAAQ;CAEtB,MAAM,YAAY,OAAO,MAAM,KAC7B,MAAM,OACN,MAAM,MAAM,OAAO;GAAG,MAAM,WAAW,QAAQ;GAAW,MAAM,SAAS,OAAO;CAAO,CAAC,GACxF;EAAE,OAAO;EAAG,MAAM;EAAO,SAAS;CAAM,CAC1C,EAAA,CAAG,KAAK;CAER,IAAI,aAAa,KAAA,GAAW,OAAO,KAAA;CACnC,MAAM,WAAW,gBAAgB,OAAO,SAAS,MAAM,SAAS;CAEhE,IAAI,SAAS,YAAY,kBAAkB,CAAC,cAAc,UAAU,MAAM,GAAG,OAAO,KAAA;CACpF,MAAM,OAAO,OAAO,QAAQ,SAAS,UAAU,IAAI;CAEnD,IAAI,CAAC,MAAM,OAAO,KAAA;CAClB,MAAM,OAAO,OAAO,SAAS,SAAS,OAAO,MAAM;CAEnD,IACE,SAAS,KAAA,KACT,KAAK,UAAU,aACf,gBAAgB,OAAO,KAAK,QAAQ,MAAM,gBAAgB,OAAO,QAAQ,KACzE,CAAC,iBAAiB,KAAK,UAAU,KAAK,QAAQ,OAAO,KACrD,EAAE,OAAO,MAAM,MAAM,cAAc,SAAS,QAAQ,CAAC,IAErD,OAAO,KAAA;CACT,MAAM,eAAe,KAAK,GAAG,MAAM,cAAc,SAAS,QAAQ,CAAC;CAEnE,OAAO,KAAK;AACd,CAAC;AAED,MAAa,oBAAoB,OAAO,GAAG,2BAA2B,CAAC,CAAC,WACtE,SACA,OAMA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,UAAU,OAAO,WAAW,OAAO;CAEzC,IAAI,YAAY,KAAA,KAAa,MAAM,OAAO,aAAa,QAAQ,UAC7D,OAAO,EAAE,MAAM,WAAW;CAC5B,OAAO,cAAc,OAAO;CAC5B,OAAO,iBAAiB,OAAO;CAC/B,MAAM,OAAO,OAAO,QAAQ,SAAS,MAAM,UAAU,IAAI;CACzD,MAAM,OAAO,OAAO,SAAS,SAAS,MAAM,OAAO,MAAM;CAEzD,IAAI,SAAS,KAAA,KAAa,KAAK,UAAU,aAAa,CAAC,cAAc,KAAK,UAAU,MAAM,MAAM,GAC9F,OAAO,EAAE,MAAM,WAAW;CAC5B,UAAU,gBAAgB,OAAO,KAAK,QAAQ,MAAM,gBAAgB,OAAO,MAAM,QAAQ,CAAC;CAC1F,IACE,CAAC,QACD,CAAC,iBAAiB,KAAK,UAAU,KAAK,QAAQ,OAAO,KACrD,cAAc,OAAO,OAAO,MAAM,cAAc,OAAO,MAAM,MAAM,KACnE,EAAE,OAAO,MAAM,MAAM,cAAc,SAAS,KAAK,QAAQ,CAAC,MAC1D,EAAE,OAAO,MAAM,MACb,mBACE,SACA,CAAC,KAAK,QAAQ,OAAO,GACrB,KAAK,UACL,KAAA,GACA,CAAC,GACD,OACA,KACF,CACF,IACA;EACA,IAAI,MAAM,OAAO,2BAA2B,SAAS,KAAK,QAAQ;EAClE,OAAO,aAAa,SAAS,MAAM,UAAU;EAE7C,OAAO,EAAE,MAAM,WAAW;CAC5B;CACA,OAAO,YAAY,SAAS,KAAK,UAAU,KAAK,QAAQ,KAAA,CAAS;CACjE,MAAM,kBAAkB,OAAO,MAAM,IAAI,QAAQ,KAAK;CAEtD,MAAM,QAAQ,oBAAoB,cAAc;EAC9C,UAAU,KAAK;EACf,SAAS,MAAM;EACf;EACA,sBAAsB,KAAK,IACzB,kBAAkB,KAAK,SAAS,qBAChC,KAAK,SAAS,eAChB;CACF,CAAC;CAED,MAAM,QAAQ,QAAQ;CAEtB,OAAO,MAAM,OACX,MAAM,OACN;GAAG,MAAM,WAAW,QAAQ;GAAW,MAAM,SAAS,KAAK,SAAS;CAAO,GAC3E;GACG,MAAM,QAAQ,MAAM,OAAO;GAC3B,MAAM,UAAU,MAAM;GACtB,MAAM,UAAU,MAAM;GACtB,MAAM,YAAY,QAAQ,MAAM,cAAc,MAAM,eAAe;GACnE,MAAM,iBAAiB,QAAQ,MAAM,cAAc,MAAM,oBAAoB;CAChF,CACF;CACA,OAAO,eAAe,SAAS,KAAK,UAAU,KAAA,CAAS;CACvD,OAAO,eAAe,SAAS,CAAC,KAAK,QAAQ,OAAO,GAAG,KAAK,UAAU,KAAA,CAAS;CAC/E,MAAM,eAAe,KAAK,GAAG,MAAM,cAAc,SAAS,KAAK,UAAU,KAAK,CAAC;CAE/E,OAAO;EAAE,MAAM;EAAW;CAAM;AAClC,CAAC;AAED,MAAa,qBAAqB,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACxE,SACA,OACA,SACA;CACA,OAAO,WAAW,OAAO;CACzB,OAAO,cAAc,OAAO;CAC5B,OAAO,iBAAiB,OAAO;CAC/B,MAAM,OAAO,OAAO,SAAS,SAAS,MAAM,SAAS,MAAM;CAE3D,IACE,SAAS,KAAA,KACT,KAAK,UAAU,aACf,KAAK,UAAU,KAAA,KACf,KAAK,MAAM,YAAY,MAAM,WAC7B,KAAK,MAAM,oBAAoB,MAAM,mBACrC,KAAK,MAAM,yBAAyB,MAAM,wBAC1C,gBAAgB,OAAO,KAAK,QAAQ,MAAM,gBAAgB,OAAO,MAAM,QAAQ,GAE/E,OAAO;CAET,IAAI,YAAY,YAAY,OAAO,2BAA2B,SAAS,MAAM,QAAQ;CAErF,OAAO,OAAO,aAAa,SAAS,MAAM,OAAO;AACnD,CAAC"}

package/dist/drizzle/passkey-registration-custody.mjs

@@ -0,0 +1,51 @@
+import { CurrentPasskeyTransaction, ceremonyStorage, equal, handleKey, invariant } from "./passkey-state.mjs";
+import { Effect } from "effect";
+//#region src/drizzle/passkey-registration-custody.ts
+/** SQL-local writers have no external provisioning work. A definite terminal
+* rejection can release only its exact still-reserved handle; ambiguous owners
+* retain custody, and an accepted transaction no longer matches this reservation. */
+const releaseRegistrationCustody = Effect.fn("passkey.releaseRegistrationCustody")(function* (mapping, ceremony) {
+	if (mapping.registration === void 0 || ceremony.context._tag !== "Registration") return;
+	const owner = yield* CurrentPasskeyTransaction;
+	const handle = mapping.handle;
+	const intent = mapping.intent;
+	const hashed = handleKey(ceremony.profile.rpId, ceremony.context.userHandle);
+	const held = (yield* owner.read(handle.table, equal(handle.table, { [handle.handleKey]: hashed }), { limit: 1 })).rows[0];
+	const row = (yield* owner.read(intent.table, equal(intent.table, {
+		[intent.moduleId]: mapping.moduleId,
+		[intent.flowId]: ceremony.flowId
+	}), { limit: 1 })).rows[0];
+	if (row === void 0 || !intent.isPendingState(row[intent.state])) return;
+	invariant(held !== void 0 && handle.isReservedState(held[handle.state]) && held[handle.reservationId] === row[intent.reservationId] && row[intent.handleKey] === hashed && row[intent.commandId] === ceremony.commandId && row[intent.ceremonySnapshot] === ceremonyStorage.encode(ceremony));
+	yield* owner.update(intent.table, {
+		[intent.moduleId]: mapping.moduleId,
+		[intent.flowId]: ceremony.flowId
+	}, {
+		[intent.state]: intent.rejectedState,
+		[intent.version]: owner.marker
+	});
+	yield* owner.remove(handle.table, { [handle.handleKey]: hashed });
+});
+/** Keep the command/flow tombstone after retention, without retaining the
+* application registration payload or ceremony. Ambiguous custody is never scrubbed. */
+const scrubRegistrationIntent = Effect.fn("passkey.scrubRegistrationIntent")(function* (mapping, ceremony) {
+	if (mapping.registration === void 0 || ceremony.context._tag !== "Registration") return;
+	const owner = yield* CurrentPasskeyTransaction;
+	const intent = mapping.intent;
+	const identity = {
+		[intent.moduleId]: mapping.moduleId,
+		[intent.flowId]: ceremony.flowId
+	};
+	const row = (yield* owner.read(intent.table, equal(intent.table, identity), { limit: 1 })).rows[0];
+	if (row === void 0) return;
+	invariant((row[intent.state] === intent.acceptedState || row[intent.state] === intent.rejectedState) && row[intent.commandId] === ceremony.commandId && row[intent.ceremonySnapshot] === ceremonyStorage.encode(ceremony));
+	yield* owner.update(intent.table, identity, {
+		[intent.applicationSnapshot]: "",
+		[intent.ceremonySnapshot]: "",
+		[intent.version]: owner.marker
+	});
+});
+//#endregion
+export { releaseRegistrationCustody, scrubRegistrationIntent };
+
+//# sourceMappingURL=passkey-registration-custody.mjs.map